Some OSINT Twitter Accounts That Reported Russian Troop Movements Suddenly Suspended, What's This?

JAKARTA - As Russian troops and their armored vehicles began moving into Ukrainian territory, social media accounts sharing pictures and videos from the eastern Donbas and Luhansk regions have become an important source of information.

They could share footage of Russian helicopters heading for Crimea or tank divisions moving to the border. The owner of this account who shared this video is commonly known as open source intelligence or OSINT.

However, as the conflict escalated, many researchers who shared this key material taken from social media, suddenly found their Twitter accounts suddenly suspended.

Open Source Intelligence (OSINT) is the practice of gathering information from published or publicly available sources. Many IT security departments are increasingly tasked with performing OSINT operations in their own organizations to support operational security. The OSINT framework focuses on gathering information from free tools or resources.

On the evening of February 22nd, OSINT researcher Kyle Glen had his account locked for 12 hours. This is known from Glen's tweet and a post shared by another OSINT organization. Security analyst Oliver Alexander also claims his account was also locked twice in 24 hours.

Outside of the Anglosphere, French OSINT accounts, Neurone Intelligence, Spanish accounts, Mundo en Conflicto, and Brazilian OSINT accounts, Notícias e Guerras, were also affected.

A Twitter thread compiled by Nick Waters, an analyst at start-up organization OSINT Bellingcat, lists more account suspensions. In a tweet, Alexander shared a screenshot with a message stating that the account had been locked for violating Twitter rules, although the exact rule violation was not specified.

Researchers raised concerns that the account suspension could be part of a mass reporting campaign meant to deactivate OSINT accounts during the Russian invasion.

I am back again after having been locked out twice in 24 hours. First time for a post debunking the "foiled sabotage / gas attack" and second time for a post debunking the "Ukrainian attack into Russia". @Twitter needs to do something against these locks now.

— Oliver Alexander (@OAlexanderDK) February 23, 2022

In a statement, Twitter spokeswoman Elizabeth Busby said that action was taken against these accounts in error and was not part of a coordinated campaign.

"We are proactively monitoring emerging narratives that violate our policies, and, in this case, we are taking enforcement action on a number of accounts for misconduct," said Busby. “We are reviewing this action immediately and have been proactively restoring access to a number of affected accounts. Claims that the error was a coordinated bot campaign or mass reporting results are inaccurate."

When asked what content policies the suspended accounts believe the suspended accounts have violated, Busby pointed The Verge at Twitter's synthetic media policies and manipulation. This relates to the sharing of misinformation on the platform.

Under the terms of the policy, accounts may not share information that has been “significantly and deceptively altered, manipulated, or fabricated”, “shared in a deceptive manner or in the wrong context”, or “is likely to cause widespread confusion in a public matter. , impact public safety, or cause serious damage.”

But it's not clear how exactly the suspended account was deemed to have violated the policy.

Aric Toler, director of research and training at Bellingcat, told The Verge that the suspension was surprising given the number of English-language accounts affected.

"Usually when this happens, it happens to relatively smaller accounts and accounts in foreign languages, because Twitter mods don't have as much language capability there," Toler said. “But here you also get a lot of people tweeting in English, some pretty big accounts with tens of thousands of followers also down. It's a bit strange."

Toler also highlighted the fact that many of the suspended accounts were aggregator accounts, retweeting other accounts that posted original content, rather than directly sharing pictures and videos. According to Toler, this indicates the possibility that the aggregator's account has been suspended due to human intervention rather than algorithmic content moderation.

Ukrainian supporters worry that removing Twitter accounts sharing OSINT from the region could benefit Russia's military objectives in the disputed region. Russia has previously carried out a social media disinformation campaign in Ukraine and is accused of weaponizing social media to promote false narratives during its 2014 annexation of Crimea.

Russia has also expanded its digital offensive by increasing its ongoing cyberattacks in Ukraine, targeting Ukrainian banks and government websites with ongoing DDoS attacks.

However, Toler said Twitter has been responsive in recovering suspended accounts, and the removal of the OSINT aggregator is unlikely to have any long-term impact on media releases from the region.

"If something is missing on Twitter, it will be elsewhere, on Telegram, Facebook, many other platforms," Toler said. “The aggregators pass it on to everyone like us [journalists] who follow it. So the biggest impact is on second-level information, but not on the original source."